;)
;)
;)
;)
;)
;)
;)
;)
;)
In this article, we’ll cover common SSL issues that you might encounter on your website.
Mixed Content
One of the most common reasons an SSL-protected website still shows as “Not Secure” is something called mixed content.
When an SSL certificate is installed, your website is expected to load entirely over a secure connection (HTTPS). This means every part of the page must be delivered securely, not just the main address.
Mixed content happens when:
- The website itself loads securely using https://
- But some parts of the page still load using http://
Even if only one item on the page is insecure, the browser no longer considers the page fully secure.
Why Mixed Content Causes SSL Warnings
SSL works by encrypting all data sent between your website and its visitors. This encryption only applies to content loaded over HTTPS.
When insecure (HTTP) content is included on a secure (HTTPS) page:
- That content is not encrypted
- Browsers cannot guarantee visitor safety
- The secure connection is considered incomplete
Because of this, modern browsers will:
- Remove the padlock icon
- Show a “Not Secure” warning
- Block certain parts of the website from loading
This can make it appear as though SSL is not working, even though the certificate itself is installed correctly.
Important Clarification
Mixed content does not mean your SSL certificate is broken or invalid. It means:
- The SSL certificate is active
- The website is partially secure
- The page fails security checks because not all content is encrypted
Browsers evaluate the security of the entire page, not just the certificate.
Common Causes of Mixed Content
Mixed content usually appears when:
- Themes or plugins load files using HTTP
- External services or embeds do not use HTTPS
How to Fix Mixed Content
For WordPress Websites
If your WordPress website is showing SSL warnings due to mixed content, you can fix it by updating old links from http:// to https://. The easiest way to do this is with the Better Search Replace plugin.
Step 1: Make a Backup (Important)
Before making any changes:
- Backup your website files and database
- This ensures you can restore your site if anything goes wrong
Step 2: Install and Activate Better Search Replace
Log in to your WordPress admin dashboard
- Go to Plugins → Add New
- Search for Better Search Replace
- Click Install Now, then Activate
Step 3: Open Better Search Replace
Once activated, you can find the plugin in the WordPress menu:
Go to Tools → Better Search Replace
Step 4: Update Links:
- In the Search for field, enter http
- In the Replace with field, enter https
- Select the database tables you want to update (usually all tables are fine)
- Run a dry run first (this will show how many changes will be made without actually changing anything)
- If everything looks correct, run the replacement for real
Step 5: Clear Cache
- Clear your WordPress cache if you use a caching plugin
- Clear your browser cache
- If you use a CDN, clear that cache as well
For Non-WordPress Websites
If your site does not use WordPress:
- Update all website links from http:// to https://
- Check images, scripts, and embedded content
Expired certificate
You can check if your SSL certificate has expired by going to your website and clicking on the padlock icon to view the certificate.
Steps to check the validity period:
Firefox:
- Click on the padlock
- Click on ‘Connection secure’
- Click on ‘More Information’
- Click on ‘View Certificate’
- Check the validity period
Chrome:
- Click on the settings button
- Click on ‘Connection is secure’
- Click on ‘Certificate is valid’
- Check the validity period
For cPanel:
- Go to the ‘Security’ section
- Click on ‘SSL/TLS Status’
- Check if the Auto-SSL is running and the domains are included
- Allow a few minutes for Auto-SSL to install a new SSL certificate
For Managed WordPress
The Auto-SSL feature is running constantly in the background making sure that your website is covered by a SSL certificate.
If you have any concerns that your SSL certificate did not renew, please don’t hesitate to reach out and we’ll gladly assist.
SSL certificate issuance and propagation.
Depending on the type of SSL certificate you choose, the issuance time can vary:
Domain Validated (DV) certificate:
- In this category are the Let’s Encrypt SSL certificates and our Simple SSL Certificate
- These can take anywhere from a few minutes to a few hours to be activated and installed
Organisation Validation (OV) certificate:
- In this category are our Organisational certificates and our Wildcard Organisational Certificates
- These can take a few days to activate as these require some additional checks
Extended Validation (EV) certificate:
- In this category are our Extended certificates
- These certificates take the longest to activate as these require even more verifications. You can expect this to take a few days as well
Print Article
Email Article to Friend
Export to PDF